Jetpack – AI Agents & MCP, Security, Backup & Analytics vulnerabilities
Plugin slug jetpack · 33 known vulnerabilities · latest disclosed 2026-10-07 · WordPress.org page
Every listed vulnerability has a fix. Version 16.3 or later is not affected by any of them. If your site runs an older version, update it.
6 of 33 rated high or critical (CVSS 7 or more).
Known vulnerabilities in Jetpack – AI Agents & MCP, Security, Backup & Analytics
| Severity | Affected versions | Fixed in | CVE | Published | Details |
|---|---|---|---|---|---|
| Medium 5.3 | <= 16.2 | 16.3 | CVE-2026-106601 | 2026-10-07 | Advisory |
| Medium 5.3 | <= 16.2 | 16.3 | CVE-2026-106602 | 2026-10-07 | Advisory |
| High 7.2 | 16.1 to 16.1.2 | 16.1.3 | none | 2026-09-08 | Advisory |
| Medium 6.6 | 16.1 to 16.1.2 | 16.1.3 | none | 2026-09-05 | Advisory |
| Medium 6.6 | 16.1 to 16.1.2 | 16.1.3 | none | 2026-09-05 | Advisory |
| High 7.2 | 12.0 to 12.0.2, 12.1 to 12.1.2, 12.2 to 12.2.2, 12.3 to 12.3.1, 12.4 to 12.4.1, 12.5 to 12.5.1, 12.6 to 12.6.3, 12.7 to 12.7.2, 12.8 to 12.8.2, 12.9 to 12.9.4, 13.0 to 13.0.1, 13.1 to 13.1.4, 13.2 to 13.2.3, 13.3 to 13.3.2, 13.4 to 13.4.4, 13.5 to 13.5.1, 13.6 to 13.6.1, 13.7 to 13.7.1, 13.8 to 13.8.2, 13.9 to 13.9.1, 14.0, 14.1, 14.2 to 14.2.1, 14.3, 14.4 to 14.4.1, 14.5, 14.6, 14.7, 14.8, 14.9 to 14.9.1, 15.0 to 15.0.2, 15.1 to 15.1.1, 15.2, 15.3 to 15.3.1, 15.4, 15.5, 15.6, 15.7 to 15.7.1, 15.8, 15.9 to 15.9.1, 16.0 to 16.0.1, 16.1 to 16.1.2 | 12.0.3 | none | 2026-09-03 | Advisory |
| Medium 6.1 | 14.5, 14.6, 14.7, 14.8, 14.9 to 14.9.1, 15.0 to 15.0.2, 15.1 to 15.1.1, 15.2, 15.3 to 15.3.1, 15.4, 15.5, 15.6, 15.7 to 15.7.1, 15.8, 15.9 to 15.9.1, 16.0 to 16.0.1, 16.1 to 16.1.2 | 14.5.1 | none | 2026-09-03 | Advisory |
| Medium 4.3 | 3.2 to 16.1.2 | 16.1.3 | none | 2026-09-03 | Advisory |
| Medium 6.1 | 13.0 to 14.0 | 14.1 | CVE-2024-10858 | 2024-12-04 | Advisory |
| Medium 6.5 | <= 13.7 | 13.8 | CVE-2024-10075 | 2024-10-17 | Advisory |
| Medium 6.4 | <= 13.7 | 13.8 | CVE-2024-10076 | 2024-10-17 | Advisory |
| Medium 4.3 | 10.0 to 10.0.1, 10.1 to 10.1.1, 10.2 to 10.2.2, 10.3 to 10.3.1, 10.4 to 10.4.1, 10.5 to 10.5.2, 10.6 to 10.6.1, 10.7 to 10.7.1, 10.8 to 10.8.1, 10.9 to 10.9.2, 11.0 to 11.0.1, 11.1 to 11.1.3, 11.2 to 11.2.1, 11.3 to 11.3.3, 11.4 to 11.4.1, 11.5 to 11.5.2, 11.6 to 11.6.1, 11.7 to 11.7.2, 11.8 to 11.8.5, 11.9 to 11.9.2, 12.0 to 12.0.1, 12.1 to 12.1.1, 12.2 to 12.2.1, 12.3, 12.4, 12.5, 12.6 to 12.6.2, 12.7 to 12.7.1, 12.8 to 12.8.1, 12.9 to 12.9.3, 13.0, 13.1 to 13.1.3, 13.2 to 13.2.2, 13.3 to 13.3.1, 13.4 to 13.4.3, 13.5, 13.6, 13.7, 13.8 to 13.8.1, 13.9, 3.9 to 3.9.9, 4.0 to 4.0.6, 4.1 to 4.1.3, 4.2 to 4.2.4, 4.3 to 4.3.4, 4.4 to 4.4.4, 4.5 to 4.5.2, 4.6 to 4.6.2, 4.7 to 4.7.3, 4.8 to 4.8.4, 4.9 to 4.9.2, 5.0 to 5.0.2, 5.1 to 5.1.3, 5.2 to 5.2.4, 5.3 to 5.3.3, 5.4 to 5.4.3, 5.5 to 5.5.4, 5.6 to 5.6.4, 5.7 to 5.7.4, 5.8 to 5.8.3, 5.9 to 5.9.3, 6.0 to 6.0.3, 6.1 to 6.1.4, 6.2 to 6.2.4, 6.3 to 6.3.6, 6.4 to 6.4.5, 6.5 to 6.5.3, 6.6 to 6.6.4, 6.7 to 6.7.3, 6.8 to 6.8.4, 6.9 to 6.9.3, 7.0 to 7.0.4, 7.1 to 7.1.4, 7.2 to 7.2.4, 7.3 to 7.3.4, 7.4 to 7.4.4, 7.5 to 7.5.6, 7.6 to 7.6.3, 7.7 to 7.7.5, 7.8 to 7.8.3, 7.9 to 7.9.3, 8.0 to 8.0.2, 8.1 to 8.1.3, 8.2 to 8.2.5, 8.3 to 8.3.2, 8.4 to 8.4.4, 8.5 to 8.5.2, 8.6 to 8.6.3, 8.7 to 8.7.3, 8.8 to 8.8.4, 8.9 to 8.9.3, 9.0 to 9.0.4, 9.1 to 9.1.2, 9.2 to 9.2.3, 9.3 to 9.3.4, 9.4 to 9.4.3, 9.5 to 9.5.4, 9.6 to 9.6.3, 9.7 to 9.7.2, 9.8 to 9.8.2, 9.9 to 9.9.2 | 3.9.10 | CVE-2024-9926 | 2024-10-14 | Advisory |
| Medium 6.4 | <= 13.3.1 | 13.4 | CVE-2024-4392 | 2024-05-13 | Advisory |
| Medium 6.4 | <= 12.8-a.1 | 12.8-a.3 | CVE-2023-45050 | 2023-11-16 | Advisory |
| Medium 5 | < 12.7 | 12.7 | CVE-2023-47774 | 2023-11-16 | Advisory |
| Medium 4.3 | < 12.7 | 12.7 | CVE-2023-47788 | 2023-11-16 | Advisory |
| Medium 6.5 | 10.0, 10.1, 10.2 to 10.2.1, 10.3, 10.4, 10.5 to 10.5.1, 10.6 to 10.6.1, 10.7, 10.8, 10.9 to 10.9.1, 11.0, 11.1 to 11.1.2, 11.2, 11.3 to 11.3.2, 11.4, 11.5 to 11.5.1, 11.6, 11.7 to 11.7.1, 11.8 to 11.8.4, 11.9 to 11.9.1, 12.0, 12.1, 2.0 to 2.0.8, 2.1 to 2.1.6, 2.2 to 2.2.9, 2.3 to 2.3.9, 2.4 to 2.4.6, 2.5 to 2.5.4, 2.6 to 2.6.5, 2.7 to 2.7.4, 2.8 to 2.8.4, 2.9 to 2.9.5, 3.0 to 3.0.5, 3.1 to 3.1.4, 3.2 to 3.2.4, 3.3 to 3.3.5, 3.4 to 3.4.5, 3.5 to 3.5.5, 3.6 to 3.6.3, 3.7 to 3.7.4, 3.8 to 3.8.4, 3.9 to 3.9.8, 4.0 to 4.0.5, 4.1 to 4.1.2, 4.2 to 4.2.3, 4.3 to 4.3.3, 4.4 to 4.4.3, 4.5 to 4.5.1, 4.6 to 4.6.1, 4.7 to 4.7.2, 4.8 to 4.8.3, 4.9 to 4.9.1, 5.0 to 5.0.1, 5.1 to 5.1.2, 5.2 to 5.2.3, 5.3 to 5.3.2, 5.4 to 5.4.2, 5.5 to 5.5.3, 5.6 to 5.6.3, 5.7 to 5.7.3, 5.8 to 5.8.2, 5.9 to 5.9.2, 6.0 to 6.0.2, 6.1 to 6.1.3, 6.2 to 6.2.3, 6.3 to 6.3.5, 6.4 to 6.4.4, 6.5 to 6.5.2, 6.6 to 6.6.3, 6.7 to 6.7.2, 6.8 to 6.8.3, 6.9 to 6.9.2, 7.0 to 7.0.3, 7.1 to 7.1.3, 7.2 to 7.2.3, 7.3 to 7.3.3, 7.4 to 7.4.3, 7.5 to 7.5.5, 7.6 to 7.6.2, 7.7 to 7.7.4, 7.8 to 7.8.2, 7.9 to 7.9.2, 8.0 to 8.0.1, 8.1 to 8.1.2, 8.2 to 8.2.4, 8.3 to 8.3.1, 8.4 to 8.4.3, 8.5 to 8.5.1, 8.6 to 8.6.2, 8.7 to 8.7.2, 8.8 to 8.8.3, 8.9 to 8.9.2, 9.0 to 9.0.3, 9.1 to 9.1.1, 9.2 to 9.2.2, 9.3 to 9.3.3, 9.4 to 9.4.2, 9.5 to 9.5.3, 9.6 to 9.6.2, 9.7 to 9.7.1, 9.8 to 9.8.1, 9.9 to 9.9.1 | 2.0.9 | CVE-2023-2996 | 2023-05-30 | Advisory |
| Medium 5.3 | 2.0 to 2.0.8, 2.1 to 2.1.6, 2.2 to 2.2.9, 2.3 to 2.3.9, 2.4 to 2.4.6, 2.5 to 2.5.4, 2.6 to 2.6.5, 2.7 to 2.7.4, 2.8 to 2.8.4, 2.9 to 2.9.5, 3.0 to 3.0.5, 3.1 to 3.1.4, 3.2 to 3.2.4, 3.3 to 3.3.5, 3.4 to 3.4.5, 3.5 to 3.5.5, 3.6 to 3.6.3, 3.7 to 3.7.4, 3.8 to 3.8.4, 3.9 to 3.9.8, 4.0 to 4.0.5, 4.1 to 4.1.2, 4.2 to 4.2.3, 4.3 to 4.3.3, 4.4 to 4.4.3, 4.5 to 4.5.1, 4.6 to 4.6.1, 4.7 to 4.7.2, 4.8 to 4.8.3, 4.9 to 4.9.1, 5.0 to 5.0.1, 5.1 to 5.1.2, 5.2 to 5.2.3, 5.3 to 5.3.2, 5.4 to 5.4.2, 5.5 to 5.5.3, 5.6 to 5.6.3, 5.7 to 5.7.3, 5.8 to 5.8.2, 5.9 to 5.9.2, 6.0 to 6.0.2, 6.1 to 6.1.3, 6.2 to 6.2.3, 6.3 to 6.3.5, 6.4 to 6.4.4, 6.5 to 6.5.2, 6.6 to 6.6.3, 6.7 to 6.7.2, 6.8 to 6.8.3, 6.9 to 6.9.2, 7.0 to 7.0.3, 7.1 to 7.1.3, 7.2 to 7.2.3, 7.3 to 7.3.3, 7.4 to 7.4.3, 7.5 to 7.5.5, 7.6 to 7.6.2, 7.7 to 7.7.4, 7.8 to 7.8.2, 7.9 to 7.9.2, 8.0 to 8.0.1, 8.1 to 8.1.2, 8.2 to 8.2.4, 8.3 to 8.3.1, 8.4 to 8.4.3, 8.5 to 8.5.1, 8.6 to 8.6.2, 8.7 to 8.7.2, 8.8 to 8.8.3, 8.9 to 8.9.2, 9.0 to 9.0.3, 9.1 to 9.1.1, 9.2 to 9.2.2, 9.3 to 9.3.3, 9.4 to 9.4.2, 9.5 to 9.5.3, 9.6 to 9.6.2, 9.7 to 9.7.1 | 2.0.8 | CVE-2021-24374 | 2021-06-01 | Advisory |
| Medium 6.4 | < 5.1, 5.1 to 5.1.1, 5.2 to 5.2.2, 5.3 to 5.3.1, 5.4 to 5.4.1, 5.5 to 5.5.2, 5.6 to 5.6.2, 5.7 to 5.7.2, 5.8 to 5.8.1, 5.9 to 5.9.1, 6.0 to 6.0.1, 6.1 to 6.1.2, 6.2 to 6.2.2, 6.3 to 6.3.4, 6.4 to 6.4.3, 6.5 to 6.5.1, 6.6 to 6.6.2, 6.7 to 6.7.1, 6.8 to 6.8.2, 6.9 to 6.9.1, 7.0 to 7.0.2, 7.1 to 7.1.2, 7.2 to 7.2.2, 7.3 to 7.3.2, 7.4 to 7.4.2, 7.5 to 7.5.4, 7.6 to 7.6.1, 7.7 to 7.7.3, 7.8 to 7.8.1, 7.9 to 7.9.1 | 5.1.1 | none | 2019-10-19 | Advisory |
| Medium 6.1 | <= 7.0 | 7.0.1 | none | 2019-02-14 | Advisory |
| Medium 5.4 | <= 6.4.2 | 6.5 | none | 2018-12-11 | Advisory |
| Medium 6.1 | < 4.0.3 | 4.0.3 | CVE-2016-10706 | 2017-04-26 | Advisory |
| Medium 6.1 | < 4.2 | 4.2 | none | 2017-04-26 | Advisory |
| Critical 9.6 | < 4.2 | 4.2 | none | 2017-04-26 | Advisory |
| Critical 9.8 | < 4.2 | 4.2 | none | 2017-04-26 | Advisory |
| Medium 6.1 | < 4.0.4 | 4.0.4 | CVE-2016-10705 | 2016-06-20 | Advisory |
| Medium 6.1 | <= 3.9.1 | 3.9.2 | none | 2016-02-25 | Advisory |
| Medium 4.9 | <= 3.9.1 | 3.9.2 | none | 2016-02-25 | Advisory |
| Medium 5.3 | <= 3.7.1 | 3.7.2 | none | 2015-10-01 | Advisory |
| High 7.2 | <= 3.7.1 | 3.7.2 | none | 2015-10-01 | Advisory |
| High 7.2 | <= 3.5.2 | 3.5.3 | none | 2015-05-06 | Advisory |
| Medium 6.1 | < 3.4.3 | 3.4.3 | CVE-2015-9359 | 2015-04-20 | Advisory |
| Medium 5.3 | <= 1.8, 1.9 to 1.9.3, 2.0 to 2.0.8, 2.1 to 2.1.3, 2.2 to 2.2.6, 2.3 to 2.3.6, 2.4 to 2.4.3, 2.5 to 2.5.1, 2.6 to 2.6.2, 2.7 to 2.7.1, 2.8 to 2.8.1, 2.9 to 2.9.2 | 1.9.4 | CVE-2014-0173 | 2014-08-26 | Advisory |
Check if a site is affected
Enter a site address to see which version of Jetpack – AI Agents & MCP, Security, Backup & Analytics and other plugins it runs, and whether they match a known vulnerability.
Questions
Is the Jetpack – AI Agents & MCP, Security, Backup & Analytics plugin safe to use?
All 33 known issues are fixed in current versions (16.3 or later). Keeping it updated is what matters.
How do I check which version of Jetpack – AI Agents & MCP, Security, Backup & Analytics my site runs?
In WordPress go to Plugins > Installed Plugins. From the outside, the free PluginPeek scan below reads the version from the site's public files.
How do I fix a vulnerable plugin?
Make a full backup, then update it from Dashboard > Updates and check the site afterwards. If you would rather not, we can do it for a fixed $99, paid after you have checked the site.
Check any WordPress site in one click while you browse: Add PluginPeek to Chrome